Skip to content

OAuth_token is not equal to temporary_credentials->getIdentifier(), causing MITM warning #84

Open
@samjhill

Description

@samjhill

https://github.com/thephpleague/oauth1-client/blob/master/src/Client/Server/Server.php#L150

I extended Server for a different provider (SocialFlow.php file below), and after the auth redirect, I am given an OAuth_token, which I store in $_SESSION.

I also serialize and store the temporary_credentials the same way.

Then, I initialize it again, with the signature, for an endpoint run:

$server = new SocialFlow($args->client_credentials, unserialize($args->signature));
        try {
            $token = $server->getTokenCredentials(unserialize($args->temporary_credentials), $args->token_credentials['oauth_token'], $args->token_credentials['oauth_verifier']);
            return $server->getAccountsList($token);
        }...

The crux of the issue: the temporary_credentials that are given to me from SocialFlow don't have the same ID as the OAuth_token given to me after the auth redirect.

And I still get the warning Temporary identifier passed back by server does not match that of stored temporary credentials. .

What am I doing wrong?


SocialFlow extends Server.php


namespace ...;

use League\OAuth1\Client\Credentials\TokenCredentials;
use League\OAuth1\Client\Server\Server;

class SocialFlow extends Server
{
    /**
     * {@inheritDoc}
     */
    public function urlTemporaryCredentials()
    {
        return 'https://www.socialflow.com/oauth/request_token';
    }

    /**
     * {@inheritDoc}
     */
    public function urlAuthorization()
    {
        return 'https://www.socialflow.com/oauth/authorize';
    }

    /**
     * {@inheritDoc}
     */
    public function urlTokenCredentials()
    {
        return 'https://www.socialflow.com/oauth/access_token';
    }

    /**
     * {@inheritDoc}
     */
    public function urlUserDetails()
    {
        return 'https://api.socialflow.com/account/list';
    }

    /**
     * {@inheritDoc}
     */
    public function userDetails($data, TokenCredentials $tokenCredentials)
    {
        return $data; //todo
    }

    /**
     * {@inheritDoc}
     */
    public function userUid($data, TokenCredentials $tokenCredentials)
    {
        return $data['id']; //todo
    }

    /**
     * {@inheritDoc}
     */
    public function userEmail($data, TokenCredentials $tokenCredentials)
    {
        return; //todo
    }

    /**
     * {@inheritDoc}
     */
    public function userScreenName($data, TokenCredentials $tokenCredentials)
    {
        return $data['name']; //todo
    }

    /**
     * Generic GET call using authorized credentials and specified path
     *
     * @param TokenCredentials $tokenCredentials
     * @param String $url
     *
     * @return array HTTP client response
     */
    protected function genericGetCall(TokenCredentials $tokenCredentials, $url)
    {
        $client = $this->createHttpClient();

        $headers = $this->getHeaders($tokenCredentials, 'GET', $url);
        print_r($headers);
        try {
            $response = $client->get($url, [
                'headers' => $headers,
            ]);
        } catch (BadResponseException $e) {
            $response = $e->getResponse();
            $body = $response->getBody();
            $statusCode = $response->getStatusCode();

            throw new \Exception(
                "Received error [$body] with status code [$statusCode] when retrieving token credentials."
            );
        }
        switch ($this->responseType) {
            case 'json':
                return json_decode((string) $response->getBody(), true);
                break;

            case 'xml':
                return simplexml_load_string((string) $response->getBody());
                break;

            case 'string':
                return [$response->getBody()];
                break;

            default:
                throw new \InvalidArgumentException("Invalid response type [{$this->responseType}].");
        }
    }

    public function getAccountsList(TokenCredentials $tokenCredentials)
    {
        return $this->genericGetCall($tokenCredentials, 'https://api.socialflow.com/account/list');
    }
}

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions